The Insider Threat Prediction and Specification Language.
George Magklaras, Steven Furnell · INC · 2012
Various information security surveys and case studies indicate the importance and manifestation of the insider threat problem. One of the most important tools to address insider threats is to enable the researchers to build case studies and express/replay threat scenarios. The Insider Threat Prediction and Specification Language (ITPSL) is a Domain Specific Language (DSL) created to provide a systemic way to describe insider threats and misuse incidents. This paper presents the scope of creation as well as the design philosophy of the language. An early language compiler prototype and its underlying insider threat monitoring framework are presented followed by an evaluation of the language against real world insider threat scenarios. The paper concludes with a brief discussion of the future trends in insider threat monitoring and specification.